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We present new algorithms for mixed-state multi-copy entanglement distillation for pairs of qubits. 
Our algorithms perform significantly better than the best known algorithms. Better algorithms can 
be derived that are tuned for specific initial states. The new algorithms are based on a characteri- 
zation of the group of all locally realizable permutations of the 4" possible tensor products of n Bell 
states. 
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I. INTRODUCTION 

We study mixed-state multi-copy entanglement distil- 
lation protocols for pairs of qubits. We start from n iden- 
tical copies of a Bell diagonal state of 2 qubits and end up, 
after local operations and classical communication, with 
m < n Bell diagonals (possibly statistically dependent) 
with higher joint fidelity than m copies of the original 
Bell diagonal state. For non-Bell-diagonal initial states 
one can first perform n separate optimal single-copy dis- 
tillation protocols to make them Bell-diagonal Q. Our 
protocol can be used in a recurrence scheme followed by 
the hashing protocol as in H ||. We propose a proto- 
col with n — 4 and m = 1 that does significantly better 
than existing protocols. Our results can be used to find 
even better protocols for other values of n and m that 
are tuned for specific initial states. 

We see three main reasons for studying entanglement 
distillation protocols. The first and most obvious reason 
is that entanglement distillation protocols are a means 
of obtaining states that are closer to maximally entan- 
gled pure states, as needed in typical applications like 
teleportation, from mixed states that can be reached by 
sending one qubit of an entangled pair through a real- 
istic channel. A second reason to study distillation pro- 
tocols is that asymptotic protocols yield a lower bound 
for "entanglement of distillation" , an important measure 
of entanglement, that is in itself a lower bound for any 
sensible measure of entanglement Q . In this context we 
also mention the upper-bounds on entanglement of distil- 
lation obtained in J5|. A third reason is that multi-copy 
entanglement protocols can be considered as applications 
of entanglement, where more can be done in the presence 
of entangled pairs than without. We hope that studying 
these mechanisms will reveal some information on the 
important problem of how exactly the presence of en- 
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tanglement enables one to do things that are impossible 
without. 

Multi-copy mixed state entanglement distillation for 
qubit pairs was first studied in ^ [| . An improved vari- 
ant of the two-copy protocol in that paper was described 
in |(| under the title of quantum privacy amplification. 
These protocols as well as ours start from n identical 
qubit pairs in a Bell-diagonal state, shared by Alice and 
Bob. A crucial ingredient of these protocols is a local 
unitary operation, performed by Bob and Alice on their 
n qubits, that results globally in a permutation of the 4™ 
possible tensor products of Bell states. The key ingre- 
dient of this paper is a characterization, by means of a 
binary matrix group, of all possible local permutations 
of the products of Bell states. This enables a search for 
the best protocol within this setting. In section II we 
study local permutations of products of Bell states. In 
section III we discuss the new protocols. In section |v| 
we discuss the combination of our protocols with a re- 
currence scheme and the hashing protocol and show the 
strength of our protocols by computer simulations. 



II. LOCAL PERMUTATIONS OF PRODUCTS 
OF BELL STATES 

In this section we study the class of local unitary op- 
erations that can be performed by Alice and Bob locally 
and result in a permutation of the 4™ (tensor) products of 
Bell states, where n is the number of qubit pairs. These 
local permutations are the key ingredient of the new dis- 
tillation protocols described in the next section. 

We will code products of Bell states by binary vectors 
by assigning two-bit vectors to the Bell states as follows 

= ^(|00) + |11» = \B 00 ) 

|*+> = ^(|01) + |10» = |Soi> 

l*-> = 7f (100) - |H)) = \B W ) 

I*") = 71 (I 01 ) - I 10 )) = |Sii>. 
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A product of n Bell states is then described by a 
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2n-bit vector, e.g. |5 onoi) = |-Boo}|-B u )|£ i) = 
|$+)|*-)|*+). 

We will also exploit a correspondence between Bell 
states and Pauli matrices 
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A tensor product of n Bell states is then described by a 
tensor product of Pauli matrices, e.g. |$ + )|\f r_ )|\f r+ ) — > 
-^=<7o ® (Jy ® a x = ^TgOoo ® cr\i ® cr i. We wm a ^ so use 
longer vector subscripts to denote such tensor products, 
e.g. 
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In this representation of pure states of 2n qubits as 2™ x 
2™-matrices ^, local unitary operations — ► (Ua <8 
Ub)|^>), in which Alice acts on her n qubits (jointly) with 
an operation U a and Bob on his with an operation U b > 
are represented by 



(3) 



We are now in a position to state the main result of 
this section: 

Theorem 1 (i) If a local unitary operation (5) results in 
a permutation of the 4™ tensor products of n Bell states, 
this permutation can be represented on the binary vector 
representations ([![) as an affine operation 
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A T PA = P. 
where P = diag[ 
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(ii) Conversely, any such permutation can be realized by 
local unitary operations. 

Note that all multiplication and addition should be 
done modulo 2. We call a matrix A satisfying A T PA = P 
P-orthogonal. The affine and linear transformations con- 
sidered are invertible and therefore amount to a permu- 
tation of Z|". In the sequel we sometimes directly refer 
to the linear transformations as permutations. 

Proof: We first prove part (i). One can easily check 
that o~ v ■ o~ w ~ o~ v +w, where v and w are binary vector 
indices as in (S), and the ~-sign means equal up to a 
complex phase (in this case 1,2, — 1 or — i). Such a phase 
is irrelevant as the Pauli matrices here are matrix repre- 
sentations of pure state vectors. 

Assume now that Ua and U b indeed result in a permu- 
tation 7r : Zj™ — > Zl™, then the null vector is mapped to 



some vector v — 7r(0). Accordingly Uao'oUq ~ a v . Since 
(To is the identity matrix, we have Ub ~ cr v U A where * 
denotes complex conjugation. If we want to represent it 
by x — > Ax + b we clearly have to choose b = v. Note 
that ||) now reads ^ ^ U A ^U A a b . 

We now have to show that the permutation tt' : x — > 
tt(x) + b, which maps * to U A W A , is a linear P- 
orthogonal map tt' : x — > Ax. Linearity of binary 
maps means that sums are mapped to sums tt' (v + w) — 
tt' (v) + tt'(w). This is clearly true since Ua(7 v +wU a ~ 



Ua<7v<7wU\ — Ua(7 v U a Ua(7wU a . Furthermore, it can 
be verified using the commutation and anticommutation 
laws for Pauli matrices, that o~ v and o~ w are commutablc 
operators if and only if v T Pw = 0. Since o~ v and <j w 
are commutable if and only if Ua(7 v U\ and Uao~ w U\ are 
commutable, it must hold that v T A PAw — v T Pw for 
all v and w, which proves A T PA = P. 

To prove part (ii), we will first consider n = 2 and 
show that all permutations tt : x — > Ax with A 7 PA = P 
can be generated with the operations 4> u : \f — > U u ^fUl 
with U u = e^ CT " = 4= (J + io- u ) (with u G Zf). (This is 
also true for n > 2, but generators affecting more than 
2 qubits at a time will not be needed). Using a v a w — 

(—1)" Pw <t w ct v , it can be shown that <f> u translated into 
the binary language results in a permutation tt u : x — > 
x + u{u T Px) = (I + uu T P)x. 

We will now show that the group of permutations 
generated by the permutations tt u is isomorphic to 56, 
the group of all permutations of 6 elements. Next we 
will show that the group of P-orthogonal 4x4 matri- 
ces contains 6! = 720 elements, which proves that all 
P-orthogonal permutations are generated. Since no per- 
mutation (except the identity) is commutable with all 
permutations, S§ is isomorphic to the group of transfor- 
mations \q '■ $6 — * Sq : p — » QP1 where p and q are 
permutations of 6 elements. Such a transformation Xq is 
completely determined by specifying the images of the 
15 commutations pij, permutations on {1,2,3,4,5,6} 
that permute i and j. This holds because any per- 
mutation is a composition of such commutations and 
Xq(PiP2) = Xq(Pi)x q (P2). Note that the image under Xg 
of a commutation is again a commutation. As a result Sq 
is isomorphic to the group of permutations of 15 elements 
obtained by restricting \q to the commutations. We will 
show that this is exactly the group of permutations gen- 
erated by the generators tt u (which can be considered as 
permutations of 15 elements as 0000 can be left out, be- 
ing always mapped to itself). To this end we establish the 
following correspondence between nonzero 4-bit vectors 
and commutations 7 : u — > Pij'. 

0001 ~^p 5 , 6 , 0010 ^P4,6, 0011 ^p 4 ,5, 

0100 ^ P2 ,3, 0101->pi l4l 0110->pi l6l 0111->j»i |6j 

1000 ->pi, 3 , 1001 ^p 2 ,4, 1010 ^p 2 ,5, 1011 -^p 2 ,6, 
1100->J>l l2l 1101->p 3l 4, H10-»p 3l 6, 1111->P3,6. 

It can be verified that 7(7r u (a;)) = X-y(u)(l( x )) f° r a U u 
and x. So tt u and Xjlu) realize the same permutation of 
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15 elements. As a consequence, also products ir Ul ■. . ■■TT Uk 
realize the same permutations as products X-y(ui) " ■ ■ ■ ' 
Xjhik)- This finally establishes the isomorphism between 
Sq and the permutations generated by the tt u . 

It remains to be shown that there are 6! P-orthogonal 
4x4 matrices. It follows from A T PA = P that A is 
P-orthogonal if and only if all pairs of columns of A rep- 
resent commutable a ai except for the first and second or 
the third and fourth column. Therefore to make an ar- 
bitrary P-orthogonal matrix, the first column a% can be 
chosen to be any nonzero 4-bit vector (15 choices), the 
second column should satisfy a[ Pa^ — 1 (one linear con- 
dition yielding 8 possible a 2 ), the third column should be 
commutable with a\ and (two linear conditions yield- 
ing 3 choices after excluding 0000) and finally the fourth 
column should be commutable with a\ and ai and non- 
commutable with 03 (three linear conditions, yielding 2 
possibilities). This results in 15 • 8 • 3 • 2 = 720 = 6! 
possibilities. This ends the proof for n = 2. 

For n > 2 we turn to the matrix picture and show 
that every P-orthogonal matrix A can be reduced to the 
identity matrix by two-qubit operations, i.e. 4 x 4 P- 
orthogonal matrices embedded in an identity matrix on 
rows and columns 2k + 1,2k + 2, 21 + 1,21 + 2 for some 
k, I £ {0, . . . , n — 1}. We concentrate on two columns of 
A at a time, first 1 and 2, then 3 and 4 and so on and 
transform them to the corresponding columns of the iden- 
tity matrix with two-qubit operations. Assume, without 
loss of generality, that we are working on columns 1 and 
2, then we name = A{ 2 fc+i 1 2fc+2,2/+i,2i+2},{i,2}- If 

the two columns of K^ k ' [S> are commutable they can be 
thought of as the first and third column of a 4 x 4 P- 
orthogonal matrix and can be reduced by a two-qubit 
operation to the first and third column of an identity 
matrix. If the two columns of K^ k ' 1 ' are noncommutable 
they can be reduced to the first and second column of 
an identity matrix. One can see that by combining such 
two qubit operations the first two columns of A can be re- 
duced to the first two columns of an identity matrix. Due 
to the commutability relations between the columns of A, 
as a result, also the first two rows become the first rows 
of an identity matrix. One can now proceed in a simi- 
lar way with the next pairs of columns until the whole 
matrix is reduced to the identity matrix. The composi- 
tion of the inverses of all two-qubit operations that were 
applied yields a decomposition of A into two-qubit oper- 
ations that can be realized by local unitary operations as 
shown above. This ends the proof. □ 

In the proof we saw that linear transformations (b = 0) 
correspond to operations with Ub — U\, i.e. * — > 
Ua^U\. The matrices Ua that under this action map 
tensor products of Pauli matrices to tensor products of 
Pauli matrices possibly with a minus-sign are known to 
form the Clifford group, studied in |Q, [| in the context 
of quantum error correction and quantum computation. 
The P-orthogonal matrices form a group that is isomor- 
phic to a quotient group of the Clifford group. The Clif- 
ford group is known to be generated by CNOT opera- 



tions and one-qubit operations that map Pauli matrices 
to Pauli matrices. It is possible that this knowledge may 
be used to give other proofs for the theorem above. How- 
ever, we think that our set of generators and the isomor- 
phism between P-orthogonal 4x4 matrices and permuta- 
tions of 6 elements are worthwhile results in their own. It 
also follows that the CNOT operation should be decom- 
posable in terms of our generators (at least up to phase 
factors, but we can do better). One can easily verify that 
CNOT = I+j e - l 7< T i<><><>e l T <TlTO1 e~ l ?< J( ' TO1 . Note that the 

\/2 

first and last operation are actually 1-qubit operations. 

III. MIXED STATE MULTI-COPY 
ENTANGLEMENT DISTILLATION 
FROM PAIRS OF QUBITS 

The distillation protocols presented in this paper can 
be summarized as follows. 

1. Start from n identical independent Bell diagonal 
states with entanglement. This yields a mixture of 
4™ tensor products of Bell states. 

2. Apply a local permutation of these 4™ products of 
Bell states as described in the previous section. As 
a result the n qubit pairs get statistically depen- 
dent. 

3. Check whether the last n — m qubit pairs are In- 
states (|$ + ) or |$ - }). This can be accomplished 
locally by measuring both qubits of each pair in 
the |0), |1) basis, and checking whether both mea- 
surements yield the same result. 

4. If all measured pairs were |$)-states, keep the first 
m pairs. This is a new mixture of 4 m products of 
Bell states. 

This is a generalization of a protocol with n = 2 and 
m = 1, presented in ||, [|. In that protocol the applied 
local permutation consisted of a bilateral CNOT oper- 
ation by Alice and Bob. In our protocol, we will only 
consider linear permutations (b = 0) as one can easily 
see nothing can be gained by considering affine permuta- 
tions. In the next section we discuss how to choose the 
local permutation so as to obtain a good protocol. The 
main result of this section is a formula for the resulting 
state of m pairs as a function of the permutation of Bell 
states performed in step 2 of the protocol: 

Theorem 2 If Alice and Bob apply the above protocol, 
starting from n independent identical copies of a Bell di- 
agonal state poo |$+) ($+ 1 +poi |* + ) (* + 1 +P10 }($"| + 
Pn \^~) (VP - I withpoo > P01 > Pw >Pn? and with entan- 
glement, i. e. poo > \ , with in step 2 a local permutation, 
7r : x — > Ax with A T PA = P , the resulting state of the 
remaining m qubit pairs is given by 

2— £ f ^es + PA TP ,PA lBy){Byl (5) 
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where S is the subspace spanned by the rows of AP with 
indices 2m + 2, 2m + 4, . . . , In, 
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y is y extended with 2(n — to) zeros, and the long vector 
indices of p and s and B behave like the indices of a in 
the previous section, e.g. poonoi = PooPxxPox ■ 

Proof: After the permutation, and before the mea- 
surement, the state of the n qubit pairs is given 
by J2xezl n Px\ B Ax)(BAx\. The states \Ba x ) with 
(Ax) 2m +2,(Ax) 2m +4, ■■■ ,(Ax) 2n = yield |$)-states 
and will be kept. These are the states \Bax) f° r which 
x is commutable with the rows a 2m +2> • ■ ■ i&2n of AP. 
If we call the subspace of these vectors x, 1Z, the suc- 
cess rate (probability of keeping the first m pairs) is 
^2 xe jiPx- Among the states that are kept, the ones with 
(Ax)j = yj,j = 1,... ,2m yield |P y )-states. Together 
with the conditions for being kept, these are 2m + (n — m) 
independent linear conditions, yielding a coset of an 
(n — m)-dimensional subspace of Z^™. This subspace 
must be S since the latter is (n — m)-dimensional and 
satisfies all homogeneous conditions (with y = 0) by the 
P-orthogonality of A. The right coset is obtained by 
adding PA T Py (a combination of the first 2m rows of 
AP, determined by y). As a result the state of the first 
m pairs after the measurement is 

If all coefficients (for all y) are calculated, the denom- 
inator ^2 xeK p x can be calculated as the sum of the 2 2m 
numerators. If only one coefficient is needed (for in- 
stance if only the fidelity of the end state is needed) 
the denominator can be calculated in a more efficient 
way as Yj X £R.P* = 2~(™~ m ) J^xes s *- 0ne can eas " 
ily verify that s v = J^xez^i" 1 )" Px P* (First verify 
for 2 bits and then extend). Therefore X)i>es Sv = 
Y,x<£Zl n (J2ves(~^) vJ Vpx )Pv Ir x commutes with all v G 
S, (-iy Tpx = 1 for all v G S and £, eS (-l)* !rpie = 
2™ _m . If v g" S, one can easily show that half the coeffi- 
cients (—1)" Px are 1 and half are —1. Now the states x G 
1Z are exactly the ones for which x is commutable with 
all elements of S. Therefore J2xes Sx = 2"~ m J2xeizP x - 
This concludes the proof. □ 

IV. RECURRENCE SCHEMES 

With the above formula for the end state of the pro- 
tocol (Theorem 0), it is possible to derive good protocols 



by searching over all possible values for the relevant rows 
of the P-orthogonal matrix A and optimizing some qual- 
ity measure. Typically this measure will depend on the 
fidelity of the end state and the success rate of the proto- 
col (the probability of having |$)-states in the measured 
pairs). In that case, one only needs the first coefficient 
(the fidelity) and the denominator (the success rate) in 
(||), which both only depend on S, a space spanned by 
only n — m rows of S. Although this drastically limits the 
search space, it still grows exponentially with growing n. 

Therefore, to come up with schemes for large n, one 
needs to use the recurrence scheme, as was proposed for 
n = 2 and m — 1 in j^, [|. If m = 1, this scheme means 
that the above protocol is performed n times (with the 
same local permutation) and the n identical end states 
are taken as the input for a new step. Of course more 
than two steps are possible too. One could also envision 
recurrence schemes with ra/1, for instance, combining 
two end states of an n = 4,m = 2-protocol to yield the 
input for a second step with n = 4. In that case however 
the input for the second step would no longer consist of n 
independent pairs. Although this only requires a minor 
modification of the above results (p x and s x can no longer 
be interpreted as products of poo, ... ,pxx)> we will not 
consider this case in this paper. 

To end up with almost pure Bell states, the recurrence 
scheme can best be combined with the hashing proto- 
col as in |). The hashing protocol is the best known 
asymptotic protocol (for n — » oo) but can only be ap- 
plied to Bell diagonal states with high enough fidelity 
The combined protocol then consists of first applying a 
few recurrence steps and then switching to the hashing 
protocol. 

The best known n = 2, to = 1-recurrence scheme is the 
one of 0. In our language it amounts to a scheme with 
a 4 x 4 P-orthogonal matrix whose last line is 1111. It 
can be proven that this scheme yields the best achiev- 
able fidelity after one step (though not achieved with the 
best success rate) for initial probabilities that are ordered 
Poo > Pox > Pio > Pxx- F° r this reason it is also best to 
apply a pair per pair transformation after each recur- 
rence step, which reorders the probabilities of the end 
state if they are not ordered. (One can easily find such 
one-pair transformations using the theory of section II or 
equivalently using the local operations of ||.) 

Although it is probably best to search for a new pro- 
tocol for every given initial state, we propose below a 
protocol which we think is good if one does not have the 
time for such a search. We show by computer simulations 
that it performs better than the n = 2 scheme. 

Our scheme is an n = 4, to = 1 recurrence scheme 
combined with hashing, and with as the last step pos- 
sibly an n = 2, to = 1-step if this can lead to better 
performance. For the local permutation (determined 
by the P-orthogonal matrix A) we choose a permu- 
tation that is found experimentally to often lead to 
the best fidelity after one step, when starting with or- 
dered probabilities. For this reason we also apply a 
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FIG. 1: Comparison of 10-logarithm of inverse asymptotic 
yield L for input Werner states with fidelity F for proposed 
protocol (full line) and existing recurrence/hashing protocol 
(dashed line) 

reordering in between recurrence steps as discussed for 
the n — 2-protocol above. The chosen local permu- 
tation corresponds to an 8 x 8 P-orthogonal matrix 
A whose fourth, sixth and eighth row span the space 
spanned by {10111110,01101100,11101011}. This 
can be achieved by the operations 

\J = JJ* = g* 7r /4<Tio oi oo oo gi7r/4croi oo oo oi 
gi7r/4crio oo n oo g2T/4rxoo 01 10 oo 

(6) 

In this realization the first and second row of the P- 
orthogonal matrix A are 01 10 0010 and 10101010. 
These rows are needed to compute the reordering op- 
erations between the steps, for although the three values 
of p' 01 , p' w and p'n after one step of the protocol are 
fixed, their order is not. (The three cosets of iS in 1Z in 
equation (||) are fixed but not their order). 

This realization was found by exhaustive search over 
all operations that can be realized by 4 consecutive el- 
ementary two-qubit operations. If, for protocols with 
larger n for instance, no such simple realization can be 
found in a reasonable amount of time, one can always 
find a realization using the theory of section II but this 
can increase the total amount of work for the distillation 
protocol. This was also one of the reasons for choosing 
n = 4 in the proposed protocol. 

As a performance measure we have chosen the ex- 
pected average number of input pairs needed per out- 
put Bell state in an asymptotic protocol (the inverse of 
the asymptotic yield). The number of recurrence steps 
was also chosen as to optimize this measure. Fig. |l| 
shows the performance for our method (n = 4, to = 1- 
recurrence with the local permutation realized by XJ a as 
in (1q), with reordering between the steps, possibly one 



last n = 2, to = 1-step, and optimal switching to hash- 
ing protocol) and the method of || with reordering be- 
tween the steps and optimal switching to the Hashing 
protocol. For the sake of simplicity the figure only shows 
the results for Werner states (with poo = F > I and 
Poi = Pw = Pn = "^r~)i but the method also performs 
better for non- Werner states. 

To do better than this protocol for a specific initial 
Bell diagonal state, one can do several things depending 
on the amount of computing time available. One can try 
recurrence schemes with higher n and even higher to, but 
the amount of time needed increases fast with increasing 
n. There is of course no obligation to take the same 
local permutation in consecutive recurrence steps. One 
can also consider distilling more than one end state at 
once. Making two states with two n = 4,m = 1-protocols 
is just a special case of a non-optimal n = 8, to = 2- 
protocol. One can of course search for better ones if 
one has the time. In this case, the two obtained Bell 
states will not be independent but as the fidelity goes 
to 1, their dependence will vanish. Also two consecutive 
recurrence steps, say two n — 2, to = 1-steps, can be 
considered as one bigger non-optimal step, in this case 
with n = 4, to = 1. So if one has the time one can in 
theory always go for a one shot protocol (no recurrence) , 
but if one combines with the recurrence scheme one can 
always afford lower initial entanglement with the same 
amount of computing time. 



V. CONCLUSION 

We have derived new protocols for distillation of entan- 
glement from mixed states of two qubits. The protocols 
were based on a characterization of the group of all lo- 
cally realizable permutations of the 4" possible tensor 
products of n Bell states. Our protocols perform signif- 
icantly better than existing protocols as was shown by 
computer simulation. We also indicated how to derive 
even better protocols for specific initial states. 
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